Application server facilitating with client&#39;s computer for applets along with various formats

ABSTRACT

The present invention is an applet server which accepts requests for applets from client computers. A request specifies the format in which an applet is to be delivered to the requesting client computer. The applet server has a cache which it uses to store applets for distribution to client computers. If the specified form of the requested applet is available in the cache, the applet server transmits the applet to the requesting client. If the applet is not available in the cache, the server will attempt to build the applet from local resources (program code modules and compilers) and transformer programs (verifiers and optimizers). If the applet server is able to build the requested applet, it will then transmit the applet to the requesting client computer. If the applet server is unable to build the requested applet, it will pass the request to another applet server on the network for fulfillment of the request.

CROSS-REFERENCE TO RELATED APPLICATION(S)

This application is a continuation of U.S. patent application Ser. No.09/040,972, filed Mar. 18, 1998, now U.S. Pat. No. 6,324,685.

FIELD OF THE INVENTION

The present invention relates to computer operating systems and, inparticular, to a server architecture providing application caching andsecurity verification.

BACKGROUND OF THE INVENTION

The growth of the Internet's importance to business, along with theincreased dependence upon corporate networks, has created a demand formore secure and efficient computer systems. The traditional solution tothis problem has been to depend upon improvements in hardwareperformance to make up for the performance penalty that is typicallyincurred when a computer system is made more secure and stable.Increased interconnectivity has also created a need for improvedinteroperability amongst a variety of computers that are now connectedto one another. One solution to the problem of the variety of computersinterconnected via the Internet and corporate networks has been thedevelopment of portable architecture neutral programming languages. Themost widely known of these is Java, though, there are numerous otherarchitecture neutral languages.

Architecture neutral programming languages allow programs downloadedfrom a server computer to a client computer to be interpreted andexecuted locally. This is possible because the compiler generatespartially compiled intermediate byte-code, rather than fully compilednative machine code. In order to run a program, the client machine usesan interpreter to execute the compiled byte-code. The byte-codes providean architecture neutral object file format, which allows the code to betransported to multiple platforms. This allows the program to be run onany system which implements the appropriate interpreter and run-timesystem. Collectively, the interpreter and runtime system implement avirtual machine. This structure results in a very secure language.

The security of this system is premised on the ability of the byte-codeto be verified independently by the client computer. Using Java or someother virtual machine implementing technology, a client can ensure thatthe downloaded program will not crash the user's computer or performoperations for which it does not have permission.

The traditional implementations of architecture neutral languages arenot without problems. While providing tremendous cross platform support,the current implementations of architecture neutral languages requirethat every client performs its own verification and interpretation ofthe intermediate code. The high computation and memory requirements of averifier, compiler and interpreter restrict the applicability of thesetechnologies to powerful client computers.

Another problem with performing the verification process on the clientcomputer is that any individual within an organization may disable someor all of the checks performed on downloaded code. The current structureof these systems makes security management at the enterprise levelalmost impossible. Since upgrades of security checking software must bemade on every client computer, the cost and time involved in doing suchupgrades makes it likely that outdated or corrupt copies of the verifieror interpreter exist within an organization. Even when an organizationis diligent in maintaining a client based security model, the size ofthe undertaking in a large organization increases the likelihood thatthere will be problems.

There is a need for a scalable distributed system architecture thatprovides a mechanism for client computers to request and execute appletsin a safe manner without requiring the client machines to have localresources to compile or verify the code. There is a further need for asystem in which the applets may be cached in either an intermediatearchitecture neutral form or machine specific form in order to increaseoverall system performance and efficiency.

SUMMARY OF THE INVENTION

In accordance with one embodiment of the invention, an applet serverarchitecture is taught which allows client computers to request andexecute applets in a safe manner without requiring the client to havelocal resources to verify or compile the applet code. Compilation andbyte-code verification in the present invention are server based andthereby provide more efficient use of resources and a flexible mechanismfor instituting enterprise-wide security policies. The serverarchitecture also provides a cache for applets, allowing clients toreceive applet code without having to access nodes outside the localnetwork. The cache also provides a mechanism for avoiding repeatedverification and compilation of previously requested applet code sinceany client requesting a given applet will have the request satisfied bya single cache entry.

Machine specific binary code is essentially interpreted code since theprocessor for a given computer can essentially be viewed as a form of aninterpreter, interpreting binary code into the associated electronicequivalents. The present invention adds a level of indirection in theform of an intermediate language that is processor independent. Theintermediate language serves as the basis for security verification,code optimizations, or any other compile time modifications that mightbe necessary. The intermediate form allows a single version of thesource to be stored for many target platforms instead of having adifferent binary for each potential target computer. Compilations to thetarget form can either be done at the time of a cache hit or they can beavoided all together if the target machine is able to directly interpretthe intermediate form. If the compilation is done on the server, then acopy of the of the compiled code as well as the intermediate form can bestored in the cache. The performance advantage derived from caching thecompiled form as well as the intermediate depends upon the number ofclients with the same CPU.

The novel features believed characteristic of the invention are setforth in the appended claims. The invention itself, however, as well asother features and advantages thereof will best be understood byreference to the detailed description which follows, when read inconjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is diagram showing the major components which may be used toimplement an applet server in one embodiment of the present invention;

FIG. 2 a is a table which illustrates the structure of the requestformat data type;

FIG. 2 b is a table which illustrates the structure of the returned codedata type.

FIG. 3 is a diagram showing the compilation and transformation of aprogram module into an applet in a particular form.

DETAILED DESCRIPTION OF THE INVENTION

Referring to FIG. 1, an applet server architecture according to oneembodiment of the invention is based on an applet server computer 10which in turn is connected to client computer A 12, client computer B14, an external network 16 and an untrusted network 18. The appletserver computer 10 connects to client computers 12 and 14, an externalnetwork 16, and an untrusted network 18 by means of a network interface20. Typically this connection will involve one or more of the computersor networks having a connection to the Internet.

The applet server computer 10 accomplishes its objectives bymanipulating computer programs in several formats. An applet (e.g.applets 1-3, 25 a-25 c) is any form of program instructions, whether inbinary, source or intermediate format. In the case of this architecture,the applet code can either be a self contained program, or it can be acode fragment associated with a larger application.

Binary format refers to processor specific machine instructions suitablefor running natively on a given computing platform (also referred to as“target” because of the concept of “targeting” a compiler to producebinary code for a given processor type).

Source refers to non-binary applet code, generally in the form of higherlevel languages (i.e. C, C++, Java, Visual Basic, ActiveX, Fortran, andModula).

Intermediate format refers to a common intermediate byte-code that isproduced by compiling a given source code input. The intermediatebyte-code need not necessarily be Java byte-code.

Treating applets in this general sense allows client computers 12 and 14to request not only applications, but portions of applications. Clientcomputers 12 and 14 are thus able to use applet server computer 10 asthe equivalent of a loader, loading in appropriate parts of theapplication in the form of applets. In turn client computers 12 and 14can run large applications without requiring that the client computers12 and 14 have the resources to store the entire application in memoryat once.

Having the applets delivered from applet server computer 10 allows codein intermediate form to be verified, optimized, and compiled beforebeing transmitted to client computers 12 and 14. This reduces the amountof work the client computers 12 and 14 have to do and provides aconvenient way to impose global restrictions on code.

In operation, client computer A 12 transmits a request to an appletserver computer 10 requesting an applet in a particular form. The formmay be selected from a large matrix of many possible forms that can berecognized by the system. The request specifies the format (source,intermediate, or binary) in which the client wishes to receive theapplet. The request may also specify that the applet be verified or havesome other transformation operation preformed upon it. Verification,optimization and compression are examples of types of transformationoperations. The request is received by the network interface 20 of theapplet server computer 10 which passes the request onto the appletserver manager 22.

After interpreting the request, the applet server manager 22 checks tosee if the requested applet is available in the cache 24. The cache 24stores applets in a variety of formats (source, intermediate, orbinary). If the requested form of the applet is available in the cache24 (applet 1 25 a, applet 2 25 b, or applet 3 25 c in this example) theapplet server manager 22 instructs the network interface 20 to transmitthe applet to requesting client computer A 12.

If the requested applet is not available in the cache 24, then theapplet server manager 22 will attempt to build the requested applet fromlocal resources 26 and one or more transformation operations performedby one or more of the transformers 28. Local resources 26 are comprisedof compilers 30 a, 30 b and 30 c and program code modules 32 a, 32 b, 32c and 32 d. The requested applet is built by selecting one or moreprogram code modules 32 and compiling them with one or more compilers30. Transformer operations may be performed by the verifier 34 or theoptimizer 36. After the applet server manager 22 builds the applet, thenetwork interface 20 transmits the applet to the requesting clientcomputer A 12.

If the request can not be satisfied by building the applet from localresources 26 and transformers 28, the applet server manager 22 will passa request for the requested applet to external network 16 and/oruntrusted network 18. The applet server manager 22 may request theapplet in intermediate form or in executable form or it may request thelocal resources 26 and transformers 28 it needs to complete building theapplet itself.

The cache 24 is capable of responding to the following commands: GET,PUT, and FLUSH. GET is used to retrieve a given applet from the cache.PUT is used to store an applet in the cache. FLUSH is used to clear thecache of one or more entries. When the cache is unable to locate an itemin response to a GET operation, it returns a cache miss. The programwhich issued the GET command is then responsible for locating thedesired form of the applet by other means and optionally storing it inthe cache when it is retrieved (using the PUT operation). The FLUSHcommand will clear the cache of one or more entries and any subsequentGETs for the FLUSHed applet code will result in a cache miss. This isuseful if a particular applet needs to be updated from a remote serveron a periodic basis. When using PUT, the program issuing the commandspecifies a time to live (TTL) in the cache. When the TTL expires, thecache entry is removed by means of a FLUSH operation.

Local resources 26 are comprised of program modules 32 (applets insource form, not the requested form) and compilers 30. The programmodules 32 are run through the compilers 30 in order to produce appletsin the requested form. The applet server manager 20 may also direct themodules 32 to be processed by a verifier 34 or another transformer suchas an optimizer 36. Program modules 32 are program code used to buildapplets. Program modules 32 may be stored in local resources 26 insource, binary, or intermediate formats. When an applet is built it mayrequire the operation of one or more compilers 30 upon one or moreprogram modules 32. The program modules 32 may be combined andrecompiled with previously cached applets and the resulting applet maybe also cached for use at a future time. Additionally, program modules32, compilers 30 and transformers 28 (including verifiers 34 andoptimizers 36) may be distributed across a network. The applet servermanager 22 may pass requests for the components it needs to build aparticular applet back to the network interface 20 which in turn passesthe request onto the rest of the network and may include externalnetwork 16 and untrusted network 18.

FIG. 3 provides further illustration of how an applet is produced fromlocal resources and transformers. In this illustration the request isfor an optimized and verified applet compiled to a machine specificform. A program module 40 is compiled into an intermediate form programmodule 44 by an intermediate compiler 42. The intermediate form programmodule 44 is then transformed by an optimizer 46 or a verifier 48. Theresulting transformed intermediate form program module 50 is thencompiled by target compiler 52 into machine specific code applet 54.

There are two types of compilers used to build applets: intermediatecompilers 42 and target compilers 52. The intermediate compiler 42compiles program modules (source applet code) 40 and produces a commonintermediate pseudo-binary representation of the source applet code(intermediate form program module 44). The word pseudo is used becausethe intermediate form 44 is not processor specific but is still a binaryrepresentation of the source program module 40. This intermediate formcan be re-targeted and compiled for a particular processor.Alternatively, the intermediate form 44 can be interpreted by aninterpreter or virtual machine that understands the internal binaryrepresentation of the intermediate form. A target compiler 52 compilesintermediate applet code 44 into an applet 54 in a processor specificformat (binary) suitable for running natively on a given computingplatform.

Transformers 56 are programs that take in intermediate code and put outintermediate code. Transformers 56 are generally used for things likeverification and optimization. Other transformers might includedcompressors that identify portions of code that can be replaced withsmaller equivalents. Transformers can be matched up to any othercomponent that takes in intermediate code as an input. These include thecache 24 and the target compilers 52. Global policies for transformers56 can be implemented which ensure that all applets are run through someset of transformers before being returned to the client.

A verifier 48 is a type of transformer that is able to analyze inputcode and determine areas that might not be safe. The verifier 48 candetermine the level of safety. Some verifiers 48 look for areas whereunsafe or protected memory is being accessed, others might look foraccesses to system resources such as IO devices. Once a verifier 48determines the portion of unsafe applet code several steps can be taken.The offending code portion can be encased with new code thatspecifically prevents this unsafe code section from being executed. Theunsafe code can be modified to be safe. The unsafe code can be flaggedin such a way that a user can be warned about the possible risks ofexecuting the code fragment. The verifier's role can therefore besummarized as determining where unsafe code exists and possibly alteringthe offending code to render it harmless. Verifiers 48 can operate onany format of input code, whether in source, intermediate or binaryform. However, since intermediate code is a common format, it is mostefficient to have a single verifier that will operate on code in thisformat. This eliminates the need to build specific knowledge of varioussource languages into the verifier. Verifiers 48 are a form of atransformer. Verifiers 48 take in intermediate code and put out verifiedintermediate code. Verifiers 48 are responsible for identifyingnon-secure portions of code in the intermediate code and modifying thiscode to make it secure. Security problems generally include access tomemory areas that are unsafe (such as system memory, or memory outsidethe application space of the applet).

The choice of adding in the verification step can be left up to theclient computer 12, the applet server computer 10 (see FIG. 1), or canbe based on the network that the applet originated from. Server managerscan institute global policies that affect all clients by forcing allapplets to be run through the verifier 48. Alternatively, verificationcan be reserved for un-trusted networks (18 in FIG. 1), or it can beleft up to the client to determine whether the verification should beperformed. In the preferred embodiment, verification level is determinedby the applet server 10. In this way, a uniform security policy may beimplemented from a single machine (i.e., the applet server 10).

Optimizers 46 are another type of transformer program. Optimizers 46analyze code, making improvements to well known code fragments bysubstituting in optimized but equivalent code fragments. Optimizers 46take in intermediate code 44 and put out transformed intermediate code50. The transformed intermediate code 50 is functionally equivalent tothe source intermediate code 44 in that they share the same structure.

Referring again to FIG. 1, policies may be instituted on the appletserver 10 that force a certain set of request parameters regardless ofwhat the client asked for. For example, the applet server manager 22 canrun the applet through a verifier 34 or optimizer 36 regardless ofwhether the client 12 requested this or not. Since the server 10 mighthave to go to an untrusted network 18 to retrieve a given applet, itwill then run this applet through the required transformers 28,particularly the verifier 34 before returning it to the client 12. Sinceclients 12 and 14 have to go through the applet server computer 10, thisensures that clients 12 and 14 do not receive applets directly from anuntrusted network 18. In addition, since the server will be dealingdirectly with untrusted network 18, it can be set up to institutepolicies based on the network. A trusted external network 16 may betreated differently than an untrusted network 18. This will provide theability to run a verifier 34 only when dealing with an untrusted network18, but not when dealing with a trusted external network 16. In oneembodiment, all intermediate code is passed through a verifier 34 andthe source of the code merely determines the level of verificationapplied.

The client 12 is the target computer on which the user wishes to executean applet. The client 12 requests applets from the server 10 in aspecific form. Applets can be requested in various formats includingsource, intermediate and binary. In addition, an applet can be requestedwith verification and/or other compile time operations. Optionally, theclient 12 can pass a verifier to the server to provide verification. Ifthe server 10 implements its own security, then both the client andserver verifiers will be run. The verifier that is passed from theclient to the server is cached at the server for subsequentverification. The client can refer to this verifier by aserver-generated handle to avoid having to pass the verifier each timean applet is requested.

Client computers 12 and 14 requesting applet code in intermediate formatneed to have an interpreter or virtual machine capable of interpretingthe binary code in the intermediate format if the applet is to beexecuted on the client machine.

In the preferred embodiment, requests to the applet server are in aformat similar to those of an HTTP header and are comprised of tags andvalues. In one embodiment, an HTTP GET method is used to make therequest (though use of the HTTP protocol is not necessary to implementthe present invention). The request is made up of a series of tags whichspecify the requested applet, the platform on which it is to be run andthe type of code (source/intermediate/binary), a verification level andan optimization level. New tags and values can be added to extendfunctionality as needed and the applet server manager 22 will discardany tag it does not recognize. When the applet server computer 10returns the requested applet to the requesting client computer A 12, itwill transmit the request header followed by the applet code. In thisinstance, the header will additionally include a field which defines thelength of the applet code. FIG. 2 provides a table which illustrates therequest format and the returned code format.

While this invention has been described with reference to specificembodiments, this description is not meant to limit the scope of theinvention. Various modifications of the disclosed embodiments, as wellas other embodiments of the invention, will be apparent to personsskilled in the art upon reference to this description. It is thereforecontemplated that the appended claims will cover any such modificationsor embodiments as fall within the scope of the invention.

1. A method operating on a computer system for managing requests to aserver computer for applets in a client server environment wherein eachrequest for an applet specifies one form of the applet out of aplurality forms of the applet, comprising: a) receiving on said servercomputer a request from a client computer for an applet in a formselected from a plurality forms; b) compiling said applet into saidselected form from a local resource comprising at least one sourcemodule and one compiler which acts on said source module to produce saidselected form; and c) transmitting said applet in said selected form tosaid client computer.
 2. The method of claim 1, further comprising thestep of: copying said applet in said selected form to a local cacheafter compiling said applet from said local resource if said cache doesnot contain a copy of said applet in said selected form.
 3. The methodof claim 2, further comprising the step of: transmitting a request to anexternal resource for said applet in said selected form if a copy ofsaid applet is not stored in said local cache and said applet can not becompiled from said local resource, and directing said external resourceto transmit said applet in said selected form to said server computer.4. The method of claim 1, further comprising the step of: transmitting arequest to an external resource for supplying said applet in saidselected form if said applet can not be compiled from said localresource and directing said external resource to transmit said applet insaid selected form to said server computer.
 5. A method operating on acomputer system for managing requests to a server computer for appletsin a client server environment wherein each request for an appletspecifies one form of said applet out of a plurality of forms of saidapplet, comprising: a) receiving on said server computer a request froma client computer for an applet in a specified form selected from aplurality of forms; b) determining whether said applet is stored in saidspecified form in a local cache and, if so, transmitting said applet insaid specified form to said client computer; c) if said applet is notstored in said selected form in said local cache, compiling said appletinto said selected form from a local resource comprising at least onesource module and one compiler which acts on said source module toproduce said selected form and transmitting said applet in said selectedform to said client computer.
 6. The method of claim 5, furthercomprising the step of: copying said applet in said selected form tosaid cache after compiling said applet from said local resource if saidcache does not contain a copy of said applet in said form.
 7. The methodof claim 6, further comprising the step of: transmitting a request to anexternal resource for said applet in said selected form if a copy ofsaid applet is not stored in said local cache and said applet can not becompiled from said local resource, and directing said external resourceto transmit said applet in said form to said server computer.
 8. Themethod of claim 5, further comprising the step of: transmitting arequest to an external resource for said applet in said selected form ifa copy of said applet is not stored in said local cache and said appletcan not be compiled from said local resources, and directing saidexternal resource to transmit said applet in said selected form to saidserver computer.
 9. A method operating on a computer system forgenerating an applet in response to a request by a client computerwherein each request for an applet specifies one form of the applet outof a plurality forms of the applet, comprising: a) receiving on a servercomputer a request from a client computer for an applet in a formselected from a plurality forms; b) compiling an applet program moduleinto an intermediate form program module; c) transmitting said applet insaid selected form to said client computer.
 10. The method of claim 9,further comprising the step of: transforming said intermediate formprogram module into a transformed intermediate form program module withat least one transformer program.
 11. The method of claim 10, whereinsaid at least one transformer program is selected from the groupconsisting of verifying computer programs, optimizing computer programs,compressing computer programs, debugging computer programs, usagemonitoring computer programs and encrypting computer programs.
 12. Themethod of claim 11, further comprising the step of: compiling saidtransformed intermediate form program module into machine specificbinary code with a target compiler.
 13. The method of claim 10, furthercomprising the step of: compiling said transformed intermediate formprogram module into machine specific binary code with a target compiler.